26 lines
2.4 KiB
PowerShell
26 lines
2.4 KiB
PowerShell
$cgSID = 'S-1-5-21-388235164-2207693853-3666415804-1183'
|
|
$evSID = 'S-1-1-0'
|
|
$ms = 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
|
$mw = 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
|
|
$deny = @(
|
|
@('b1a10001','Edge GameAssist',$ms,'Microsoft.Edge.GameAssist'),
|
|
@('b1a10002','Paint',$ms,'Microsoft.MSPaint'),
|
|
@('b1a10003','Photos',$ms,'Microsoft.Windows.Photos'),
|
|
@('b1a10004','Store',$ms,'Microsoft.WindowsStore'),
|
|
@('b1a10005','Wallet',$ms,'Microsoft.Wallet'),
|
|
@('b1a10006','Cortana',$mw,'Microsoft.Windows.Cortana'),
|
|
@('b1a10007','Intel GFX','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelGraphicsControlPanel'),
|
|
@('b1a10008','Intel GFX2','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelGraphicsExperience'),
|
|
@('b1a10009','Intel Opt','CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3','AppUp.IntelOptaneMemoryandStorageManagement'),
|
|
@('b1a1000a','Realtek','CN=83564403-0B26-46B8-9D84-040F43691D31','RealtekSemiconductorCorp.RealtekAudioControl')
|
|
)
|
|
$r = ''
|
|
foreach ($d in $deny) {
|
|
$id = "$($d[0])-0000-0000-0000-000000000000"
|
|
$r += "<FilePublisherRule Id=`"$id`" Name=`"$($d[1])`" Description=`"`" UserOrGroupSid=`"$cgSID`" Action=`"Deny`"><Conditions><FilePublisherCondition PublisherName=`"$($d[2])`" ProductName=`"$($d[3])`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`"/></FilePublisherCondition></Conditions></FilePublisherRule>"
|
|
}
|
|
$xml = "<AppLockerPolicy Version=`"1`"><RuleCollection Type=`"Appx`" EnforcementMode=`"Enabled`"><FilePublisherRule Id=`"a9e18c21-ff8f-43cf-b9fc-db40eed693ba`" Name=`"Allow all`" Description=`"`" UserOrGroupSid=`"$evSID`" Action=`"Allow`"><Conditions><FilePublisherCondition PublisherName=`"*`" ProductName=`"*`" BinaryName=`"*`"><BinaryVersionRange LowSection=`"0.0.0.0`" HighSection=`"*`"/></FilePublisherCondition></Conditions></FilePublisherRule>$r</RuleCollection><RuleCollection Type=`"Exe`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Msi`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Script`" EnforcementMode=`"NotConfigured`"/><RuleCollection Type=`"Dll`" EnforcementMode=`"NotConfigured`"/></AppLockerPolicy>"
|
|
$path = "\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml"
|
|
$xml | Out-File $path -Encoding UTF8
|
|
Write-Output "Written: $path ($($xml.Length) chars, $($deny.Count) deny rules)"
|